{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8911781907081604, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8911782, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8911782, "class": 0 }, { "m": "az/native", "prob": 0.9812265, "class": 0 }, { "m": "az/pe", "prob": 0.2125, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-31T03:58:09Z" }, "path": "a08077f017f27e2e2c353e5a5023d401db6e4f4086b630294bb0ce98575f1468.exe", "raw": { "v": "5", "fs": [ { "f": "H(Ds)Md(Bk)", "x": 5, "ff": { "i": [ [ "msvbvm60", "ORDINAL 583" ], [ "msvbvm60", "CIcos" ], [ "msvbvm60", "adj_fptan" ], [ "msvbvm60", "vbaVarMove" ], [ "msvbvm60", "vbaHresultCheck" ], [ "msvbvm60", "vbaFreeVar" ], [ "msvbvm60", "vbaAryMove" ], [ "msvbvm60", "ORDINAL 587" ], [ "msvbvm60", "vbaStrVarMove" ], [ "msvbvm60", "vbaFreeVarList" ], [ "msvbvm60", "adj_fdiv_m64" ], [ "msvbvm60", "ORDINAL 698" ], [ "msvbvm60", "ORDINAL 514" ], [ "msvbvm60", "vbaFreeObjList" ], [ "msvbvm60", "adj_fprem1" ], [ "msvbvm60", "ORDINAL 628" ], [ "msvbvm60", "vbaSetSystemError" ], [ "msvbvm60", "ORDINAL 661" ], [ "msvbvm60", "ORDINAL 554" ], [ "msvbvm60", "vbaHresultCheckObj" ], [ "msvbvm60", "ORDINAL 557" ], [ "msvbvm60", "adj_fdiv_m32" ], [ "msvbvm60", "ORDINAL 666" ], [ "msvbvm60", "ORDINAL 667" ], [ "msvbvm60", "vbaAryDestruct" ], [ "msvbvm60", "ORDINAL 591" ], [ "msvbvm60", "vbaBoolStr" ], [ "msvbvm60", "vbaObjSet" ], [ "msvbvm60", "ORDINAL 595" ], [ "msvbvm60", "adj_fdiv_m16i" ], [ "msvbvm60", "vbaObjSetAddref" ], [ "msvbvm60", "adj_fdivr_m16i" ], [ "msvbvm60", "vbaCyStr" ], [ "msvbvm60", "vbaFPFix" ], [ "msvbvm60", "vbaFpR8" ], [ "msvbvm60", "CIsin" ], [ "msvbvm60", "vbaChkstk" ], [ "msvbvm60", "EVENT_SINK_AddRef" ], [ "msvbvm60", "vbaGenerateBoundsError" ], [ "msvbvm60", "vbaStrCmp" ], [ "msvbvm60", "vbaAryConstruct2" ], [ "msvbvm60", "vbaVarTstEq" ], [ "msvbvm60", "vbaObjVar" ], [ "msvbvm60", "DllFunctionCall" ], [ "msvbvm60", "ORDINAL 564" ], [ "msvbvm60", "adj_fpatan" ], [ "msvbvm60", "ORDINAL 569" ], [ "msvbvm60", "vbaLateIdCallLd" ], [ "msvbvm60", "ORDINAL 676" ], [ "msvbvm60", "EVENT_SINK_Release" ], [ "msvbvm60", "ORDINAL 600" ], [ "msvbvm60", "CIsqrt" ], [ "msvbvm60", "EVENT_SINK_QueryInterface" ], [ "msvbvm60", "vbaFpCmpCy" ], [ "msvbvm60", "vbaExceptHandler" ], [ "msvbvm60", "adj_fprem" ], [ "msvbvm60", "adj_fdivr_m64" ], [ "msvbvm60", "ORDINAL 608" ], [ "msvbvm60", "vbaFPException" ], [ "msvbvm60", "ORDINAL 532" ], [ "msvbvm60", "CIlog" ], [ "msvbvm60", "vbaFileOpen" ], [ "msvbvm60", "ORDINAL 647" ], [ "msvbvm60", "vbaVar2Vec" ], [ "msvbvm60", "vbaNew2" ], [ "msvbvm60", "vbaR8Str" ], [ "msvbvm60", "vbaInStr" ], [ "msvbvm60", "ORDINAL 570" ], [ "msvbvm60", "ORDINAL 571" ], [ "msvbvm60", "adj_fdiv_m32i" ], [ "msvbvm60", "adj_fdivr_m32i" ], [ "msvbvm60", "vbaStrCopy" ], [ "msvbvm60", "vbaI4Str" ], [ "msvbvm60", "vbaFreeStrList" ], [ "msvbvm60", "ORDINAL 682" ], [ "msvbvm60", "adj_fdivr_m32" ], [ "msvbvm60", "adj_fdiv_r" ], [ "msvbvm60", "ORDINAL 685" ], [ "msvbvm60", "ORDINAL 100" ], [ "msvbvm60", "vbaVarTstNe" ], [ "msvbvm60", "vbaI4Var" ], [ "msvbvm60", "ORDINAL 610" ], [ "msvbvm60", "vbaVarAdd" ], [ "msvbvm60", "vbaVarDup" ], [ "msvbvm60", "vbaStrToAnsi" ], [ "msvbvm60", "vbaFpI4" ], [ "msvbvm60", "CIatan" ], [ "msvbvm60", "vbaStrMove" ], [ "msvbvm60", "vbaCastObj" ], [ "msvbvm60", "ORDINAL 618" ], [ "msvbvm60", "allmul" ], [ "msvbvm60", "ORDINAL 545" ], [ "msvbvm60", "CItan" ], [ "msvbvm60", "CIexp" ], [ "msvbvm60", "vbaFreeStr" ], [ "msvbvm60", "vbaFreeObj" ], [ "msvbvm60", "ORDINAL 580" ] ], "m": { "pe": { "checksum": 135750.0, "checksum_valid": 1.0, "computed_checksum": 135750.0, "bound_import_count": 1.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "bound_imports_fingerprint": 2622450629.0 }, "file": { "size": 102400.0, "entropy": 4.47, "size_bytes": 102400.0 }, "binary": { "is_pie": 0.0, "code_entropy": 4.82, "data_entropy": 0.0, "string_count": 762.0, "entropy_variance": 3.91, "avg_string_length": 7.46, "max_string_length": 147.0, "code_to_data_ratio": 0.96, "string_length_stddev": 7.21, "largest_section_ratio": 0.88, "sentence_string_count": 5.0, "sentence_string_ratio": 0.01, "high_entropy_string_count": 0.0 }, "imports": { "count": 97.0 }, "sections": { "count": 3.0, "code_size": 90112.0, "entropy_max": 4.82, "entropy_mean": 2.29, "name_entropy": 3.01, "writable_count": 1.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 168, "u8", "Rich1" ], [ 432, "u8", ".text" ], [ 512, "u8", ".rsrc" ], [ 568, "u8", "MSVBVM60.DLL" ], [ 5540, "u8", "lugeta" ], [ 5652, "u8", "Radiopasteurisat" ], [ 5673, "u8", "NECROMANTI" ], [ 5733, "u8", "List1" ], [ 5761, "u8", "Check4" ], [ 5772, "u8", "Talentlsestes" ], [ 5807, "u8", "CheckIN4" ], [ 5820, "u8", "COUNTERLIFESCA" ], [ 5856, "u8", "Check3" ], [ 5867, "u8", "Projec" ], [ 5895, "u8", "Check2" ], [ 5906, "u8", "FORRETNINGSSTE" ], [ 5942, "u8", "Check1" ], [ 5953, "u8", "foeticidesaporif" ], [ 5991, "u8", "Command2" ], [ 6004, "u8", "Cartelisesmonom" ], [ 6041, "u8", "Command1" ], [ 6054, "u8", "vadefu" ], [ 6082, "u8", "Text2" ], [ 6101, "u8", "Afkortedesinc6" ], [ 6128, "u8", "Text1" ], [ 6147, "u8", "Princippersgabes" ], [ 6176, "u8", "Teenagem8" ], [ 16263, "u8", "kJ%PVWA" ], [ 21900, "u8", "Jx03O" ], [ 21932, "u8", "gUwn" ], [ 30711, "u8", "olCi" ], [ 37259, "u8", "hbGme" ], [ 50493, "u8", "xl60" ], [ 51769, "u8", "%Pkhzmd aP" ], [ 60180, "u8", "Fatilubedmme7" ], [ 60908, "u8", "Permixtive8" ], [ 60920, "u8", "Brobyggeris2" ], [ 60936, "u8", "Commercialist" ], [ 60952, "u8", "Bonasus" ], [ 60960, "u8", "Beregningsen" ], [ 63396, "wide", "Fugleflugtsli1" ], [ 63432, "wide", "valutareservecrepehanger" ], [ 63488, "wide", "Dusinusmefistomultikunsten4" ], [ 63548, "wide", "DOTTYTHERETHROU" ], [ 63584, "wide", "ROVDRIFTENNONPRESERVATIVE" ], [ 63640, "wide", "PEERLYFOLDERSSTU" ], [ 63680, "wide", "Bookholderfistulateeliank9" ], [ 63844, "u8", "C:\\Program Files (x86)\\Microsoft Visual Studio\\VB98\\VB6.OLB" ], [ 64100, "u8", "Form" ], [ 64212, "u8", "shell32.dll" ], [ 64228, "u8", "ShellExecuteEx" ], [ 64300, "u8", "mpr.dll" ], [ 64312, "u8", "WNetOpenEnumA" ], [ 64384, "u8", "kernel32" ], [ 64400, "u8", "TerminateProcess" ], [ 64476, "u8", "user32" ], [ 64488, "u8", "DdeConnect" ], [ 64556, "u8", "GetTapePosition" ], [ 64628, "u8", "advapi32.dll" ], [ 64648, "u8", "RegDeleteKeyA" ], [ 64720, "u8", "Sleep" ], [ 64784, "u8", "TrackPopupMenuEx" ], [ 64860, "u8", "CreatePipe" ], [ 64928, "u8", "SENSAPI.DLL" ], [ 64944, "u8", "IsDestinationReachableA" ], [ 65024, "u8", "GetSystemPowerStatus" ], [ 65104, "u8", "winmm.dll" ], [ 65120, "u8", "auxSetVolume" ], [ 65192, "u8", "CloseWindow" ], [ 65260, "u8", "shlwapi.dll" ], [ 65276, "u8", "PathIsUNCServerA" ], [ 65352, "u8", "SetFileSecurityA" ], [ 65428, "u8", "DuplicateIcon" ], [ 65448, "wide", "Double" ], [ 65520, "u8", "MessageBoxExA" ], [ 65588, "u8", "forbryderalbummer" ], [ 65608, "u8", "VAPOURESCENT" ], [ 65624, "u8", "Bawsint" ], [ 65632, "u8", "broderlandenes" ], [ 65648, "u8", "slangehovedenes" ], [ 65664, "u8", "PIONERINDSATSERNES" ], [ 65684, "u8", "Paralleliser" ], [ 65700, "u8", "Pistolgreb6" ], [ 65712, "u8", "Joniseredes" ], [ 65724, "u8", "Smilerynkerne" ], [ 65740, "u8", "Koncentrationslejr6" ], [ 65760, "u8", "Underactivity" ], [ 65776, "u8", "Navlerne4" ], [ 65788, "u8", "Gnathostome7" ], [ 65804, "u8", "Strukturalistens7" ], [ 65860, "wide", "Lusterware" ], [ 65892, "wide", "appendicle" ], [ 66004, "wide", "TUBOID" ], [ 66112, "wide", "True" ], [ 66208, "wide", "zana" ], [ 66224, "wide", "Fldebollens" ], [ 66252, "wide", "PANPSYCHISTIC" ], [ 66284, "wide", "derceto" ], [ 66308, "wide", "skbnetroens" ], [ 66336, "wide", "Strandbreddernes3" ], [ 66376, "wide", "Captivates" ], [ 66404, "wide", "smilelessly" ], [ 66432, "wide", "Servicetekniker7" ], [ 66480, "wide", "Internal3" ], [ 66528, "wide", "ADDS" ], [ 66544, "wide", "Frustreringens5" ], [ 66608, "wide", "rangflgers" ], [ 66636, "wide", "TEMATISERINGS" ], [ 66688, "wide", "Amyliferous9" ], [ 66720, "wide", "FGFG" ], [ 66740, "u8", "VBA6.DLL" ], [ 66752, "u8", "__vbaVarTstEq" ], [ 66768, "u8", "__vbaGenerateBoundsError" ], [ 66796, "u8", "__vbaAryConstruct2" ], [ 66816, "u8", "__vbaHresultCheck" ], [ 66880, "u8", "__vbaFPFix" ], [ 66892, "u8", "__vbaStrVarMove" ], [ 66920, "u8", "__vbaObjSetAddref" ], [ 66952, "u8", "__vbaFreeStrList" ], [ 66972, "u8", "__vbaStrToAnsi" ], [ 66988, "u8", "__vbaFileOpen" ], [ 67004, "u8", "__vbaVarMove" ], [ 67020, "u8", "__vbaSetSystemError" ], [ 67052, "u8", "__vbaLateIdCallLd" ], [ 67072, "u8", "__vbaFreeObjList" ], [ 67104, "u8", "__vbaBoolStr" ], [ 67132, "u8", "__vbaFpCmpCy" ], [ 67148, "u8", "__vbaFreeObj" ], [ 67164, "u8", "__vbaCastObj" ], [ 67192, "u8", "__vbaAryDestruct" ], [ 67212, "u8", "__vbaFreeVarList" ], [ 67244, "u8", "__vbaVarTstNe" ], [ 67260, "u8", "__vbaHresultCheckObj" ], [ 67296, "u8", "__vbaVar2Vec" ], [ 67312, "u8", "__vbaAryMove" ], [ 67328, "u8", "__vbaFreeVar" ], [ 67356, "u8", "__vbaFreeStr" ], [ 67372, "u8", "__vbaStrMove" ], [ 67400, "u8", "__vbaStrCopy" ], [ 68568, "u8", "Parabiotic" ], [ 68632, "u8", "Beregningsenheders1" ], [ 68652, "u8", "Leafage" ], [ 68660, "u8", "GULDGRUBES" ], [ 68672, "u8", "Uafhngige" ], [ 68684, "u8", "LUGTEDES" ], [ 68696, "u8", "ERRORS" ], [ 68704, "u8", "Mako2" ], [ 68712, "u8", "Soberer1" ], [ 68724, "u8", "SRINTERESSES" ], [ 68795, "u8", "8SVW" ], [ 85771, "u8", "DSVW" ], [ 87723, "u8", "PSVW" ], [ 88219, "u8", "TSVW" ], [ 89198, "u8", "_adj_fptan" ], [ 89318, "u8", "_adj_fdiv_m64" ], [ 89354, "u8", "_adj_fprem1" ], [ 89414, "u8", "_adj_fdiv_m32" ], [ 89480, "u8", "_adj_fdiv_m16i" ], [ 89518, "u8", "_adj_fdivr_m16i" ], [ 89586, "u8", "__vbaChkstk" ], [ 89600, "u8", "EVENT_SINK_AddRef" ], [ 89714, "u8", "DllFunctionCall" ], [ 89732, "u8", "_adj_fpatan" ], [ 89766, "u8", "EVENT_SINK_Release" ], [ 89788, "u8", "_CIsqrt" ], [ 89798, "u8", "EVENT_SINK_QueryInterface" ], [ 89842, "u8", "__vbaExceptHandler" ], [ 89864, "u8", "_adj_fprem" ], [ 89878, "u8", "_adj_fdivr_m64" ], [ 89896, "u8", "__vbaFPException" ], [ 89998, "u8", "_adj_fdiv_m32i" ], [ 90016, "u8", "_adj_fdivr_m32i" ], [ 90084, "u8", "_adj_fdivr_m32" ], [ 90102, "u8", "_adj_fdiv_r" ], [ 90204, "u8", "_CIatan" ], [ 90246, "u8", "_allmul" ], [ 98646, "wide", "VS_VERSION_INFO" ], [ 98738, "wide", "VarFileInfo" ], [ 98770, "wide", "Translation" ], [ 98806, "wide", "StringFileInfo" ], [ 98842, "wide", "040904B0" ], [ 98866, "wide", "CompanyName" ], [ 98892, "wide", "Indomitech Development Co." ], [ 98954, "wide", "ProductName" ], [ 99042, "wide", "FileVersion" ], [ 99068, "wide", "1.00" ], [ 99086, "wide", "ProductVersion" ], [ 99134, "wide", "InternalName" ], [ 99160, "wide", "Fatilubedmme7" ], [ 99194, "wide", "OriginalFilename" ], [ 99228, "wide", "Fatilubedmme7.exe" ] ], "v": { "file.stem": "a08077f017f27e2e2c353e5a5023d401db6e4f4086b630294bb0ce98575f1468", "pe.imphash": "5d68f4745abd9ec573cad42e76e4c31e", "pe.machine": "i386", "pe.rich.key": 2291662385, "pe.rich.hash": "b1dda0145ef1ef05b112f34b2353125c", "pe.subsystem": "windows_gui", "pe.timestamp": 1373919939, "file.basename": "a08077f017f27e2e2c353e5a5023d401db6e4f4086b630294bb0ce98575f1468.exe", "pe.image_base": 4194304, "pe.image_size": 102400, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.entry_point": 5480, "pe.headers_size": 4096, "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.file_alignment": 4096, "pe.image_hash.sha1": "4ff5db08210809a798c750023d53b61f49be9317", "pe.image_hash.sha256": "23eb2c2f59cc80ca8c6f60cbf3ce521adb0ad3ee45e31ed6a260f713057c9a77", "pe.image_hash.sha384": "d5324cd9d0f122be98cea75e20df8477b711f0d3344847377920d790ab430ca5ed1f08d84365cdc98a70032ca5bae617", "pe.image_hash.sha512": "5a7861c9dd555dd36b06738cdd39519dfd88561ab612b2cdf83737659943297fb5c9cbd27eb10b588c091c86e43a0f6b9cfc57f7351977481c59bfed891415ee", "pe.section_alignment": 4096, "pe.subsystem_version": "4.0", "pe.characteristics[0]": "relocs_stripped", "pe.characteristics[1]": "executable_image", "pe.characteristics[2]": "32bit_machine", "pe.characteristics_raw": 271, "pe.linker_major_version": 6, "build.toolchain.compiler": "msvc", "pe.bound_imports[0].name": "MSVBVM60.DLL", "pe.data_directories[0].rva": 88740, "pe.data_directories[1].rva": 98304, "pe.data_directories[2].rva": 552, "pe.data_directories[3].rva": 4096, "pe.number_of_rva_and_sizes": 16, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 40, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 2352, "pe.data_directories[2].name": "bound_import", "pe.data_directories[2].size": 32, "pe.data_directories[3].name": "iat", "pe.data_directories[3].size": 392, "pe.rich.entries[0].build_id": 14, "pe.rich.entries[1].build_id": 9, "pe.rich.entries[2].build_id": 13, "pe.rich.entries[0].use_count": 1, "pe.rich.entries[1].use_count": 1, "pe.rich.entries[2].use_count": 1, "pe.coff.dos_header_pe_pointer": 184, "pe.rich.entries[0].product_id": 7299, "pe.rich.entries[1].product_id": 8783, "pe.rich.entries[2].product_id": 9782, "pe.bound_imports[0].time_date_stamp": 1236279235 }, "id": "pe", "sc": [ [ ".text", 4096, 90112, 4.82, "r-x" ], [ ".data", 94208, 4096, 0.0, "rw-" ], [ ".rsrc", 98304, 4096, 2.03, "r--" ] ] }, "id": 0, "sz": 102400, "ts": [ { "c": 1.0, "d": "File is a compiled binary", "e": [ "a08077f017f27e2e2c353e5a5023d401db6e4f4086b630294bb0ce98575f1468.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "0xfad4" ] }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "sections.count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "imports.count = 97.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "a": "T1027.009", "c": 0.9900000095367432, "d": "VB6 runtime DLL string", "e": [ "MSVBVM60.DLL" ], "i": "objectives/command-and-control/dropper/binder::vb6-runtime-dll-text", "l": 1, "el": [ "0x238" ] }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "imports.count = 97.00" ], "i": "metadata/binary/metrics/threshold::many-imports-50", "l": 1 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "imports.count = 97.00" ], "i": "metadata/binary/metrics/structural::many-imports", "l": 2 }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "a08077f017f27e2e2c353e5a5023d401db6e4f4086b630294bb0ce98575f1468.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "a": "T1027.009", "c": 0.9900000095367432, "d": "VB6 DllFunctionCall runtime string", "e": [ "DllFunctionCall" ], "i": "objectives/command-and-control/dropper/binder::vb6-dll-function-call-text", "l": 1, "el": [ "0x15e72" ] }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032", "el": [ "0x18156" ] }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "imports.count = 97.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 762.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2, "el": [ "0x18232" ] }, { "c": 0.9200000166893005, "d": "VB6 runtime helper import", "e": [ "__vbaExceptHandler" ], "i": "metadata/binary/framework::vb6-runtime-core-helper", "l": 2, "el": [ "0x15ef2" ] }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE carries bound import descriptors", "e": [ "[{\"name\":\"MSVBVM60.DLL\",\"time_date_stamp\":1236279235,\"forwarder_ref_count\":0}]" ], "i": "metadata/build/artifact::pe-bound-imports-present", "l": 3, "el": [ "value:pe.bound_imports" ] }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "sections.count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1, "el": [ "value:pe.version.company" ] }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.88" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2, "el": [ "0x1833e" ] }, { "c": 0.9399999976158142, "d": "VB6 DllFunctionCall thunk", "e": [ "DllFunctionCall" ], "i": "micro-behaviors/dylib/lookup::vb6-dll-function-call", "l": 3, "el": [ "0x10ac" ] }, { "c": 0.8999999761581421, "d": "Microsoft Visual string", "e": [ "C:\\Program Files (x86)\\Microsoft Visual Studio\\VB98\\VB6.OLB" ], "i": "metadata/lang/compiler/native::ms-visual", "l": 2, "el": [ "0xf964" ] }, { "c": 0.9300000071525574, "d": "VB6 runtime file open helper", "e": [ "vbaFileOpen" ], "i": "micro-behaviors/fs/file/write/direct::vb6-file-open", "l": 2, "el": [ "0x10f4" ] }, { "a": "T1559", "c": 0.8999999761581421, "d": "Create anonymous pipe", "e": [ "CreatePipe" ], "i": "micro-behaviors/communications/ipc/pipe::create-pipe", "l": 2, "el": [ "0xfd5c" ] }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2, "el": [ "0x1837a" ] }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "imports.count = 97.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "a": "T1005", "c": 0.75, "d": "Regex component marker", "e": [ "imports.count = 97.00" ], "i": "micro-behaviors/fs/file/binary::file-manipulation-cond-0--inline-18739", "l": 1 }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047", "el": [ "0x1839c" ] }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "imports.count = 97.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "c": 0.8500000238418579, "d": "ShellExecuteEx API call", "e": [ "ShellExecuteEx" ], "i": "objectives/privilege-escalation/token-manipulation::shell-executeex-call", "l": 1, "el": [ "0xfae4" ] }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2, "el": [ "0x1828a" ] }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StringFileInfo" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "0x181f6" ] }, { "c": 0.9900000095367432, "d": "Exactly three sections", "e": [ "sections.count = 3.00" ], "i": "well-known/malware/worm/ludbaruma::metric-section-count-3", "l": 1 }, { "c": 1.0, "d": "PE checksum matches computed value", "e": [ "pe.checksum_valid = 1.00" ], "i": "metadata/binary/layout::pe-checksum-valid", "l": 1 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 4096)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "sections.count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.88" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1055", "c": 0.8500000238418579, "d": "Large null run in executable (64+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::large-null-run-text", "l": 1, "el": [ "0x1868" ] }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1, "el": [ "0x1868" ] }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "a08077f017f27e2e2c353e5a5023d401db6e4f4086b630294bb0ce98575f1468.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "c": 0.800000011920929, "d": "winmm library import", "e": [ "winmm.dll" ], "i": "objectives/evasion/anti-av/import-pollution::winmm-library", "l": 1, "el": [ "0xfe50" ] }, { "c": 0.6000000238418579, "d": "Very few sections (merged/stripped)", "e": [ "sections.count = 3.00" ], "i": "metadata/binary/metrics/structural::few-sections", "l": 3 }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2, "el": [ "0x1839c" ] }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetSystemPowerStatus" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032", "el": [ "0xfe00" ] }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.88" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links msvbvm60 (ORDINAL 583, CIcos, adj_fptan, vbaVarMove, vbaHresultCheck, ... +92 more)", "e": [ "msvbvm60" ], "i": "metadata/dylib::msvbvm60", "l": 2, "el": [ "97 symbols" ] }, { "a": "T1027.009", "c": 0.9950000047683716, "d": "VB6 runtime dispatch string cluster", "e": [ "DllFunctionCall", "MSVBVM60.DLL" ], "i": "objectives/command-and-control/dropper/binder::vb6-runtime-text-cluster", "l": 1, "el": [ "0x15e72", "0x238" ] } ], "sha": "a08077f017f27e2e2c353e5a5023d401db6e4f4086b630294bb0ce98575f1468", "path": "a08077f017f27e2e2c353e5a5023d401db6e4f4086b630294bb0ce98575f1468.exe", "type": "pe" } ], "tv": "52045" } }